[PATCH 3/5] wifi: ath12k: fix MLO dp_peer ID desync with firmware
From: Jose Ignacio Tornos Martinez
Date: Mon Jul 27 2026 - 12:38:50 EST
TX completions fail with:
"dp_tx: failed to find the peer with peer_id <N>"
where <N> is an ML peer_id (host-assigned ml_peer_id OR'd with
ATH12K_PEER_ML_ID_VALID, BIT(13) = 0x2000). This happens because
the firmware uses an internal monotonic counter for ML peer IDs that
does not necessarily match the host-assigned ml_peer_id. The desync
has been observed in normal MLO operation and is particularly
reproducible after firmware crash recovery, where the
create-delete-create cycle guarantees the firmware increments its
internal counter.
Currently, ath12k_dp_peer_create() stores the host-assigned
ml_peer_id (with ATH12K_PEER_ML_ID_VALID OR'd in) as dp_peer->peer_id
and immediately populates the dp_peers[] RCU lookup table at that
index. When the firmware later uses a different peer_id in its data
path descriptors, ath12k_dp_peer_find_by_peerid() looks up the wrong
index and returns NULL, causing the "failed to find peer" error on
every TX completion.
Fix this by initializing dp_peer->peer_id to ATH12K_DP_PEER_ID_INVALID
for MLO peers at creation time, deferring the dp_peers[] RCU table
population. When ath12k_dp_peer_find_by_peerid() encounters a lookup
miss for an ML peer_id (one with ATH12K_PEER_ML_ID_VALID set), it
walks dp_peers_list for an MLO peer whose peer_id is still INVALID,
syncs peer_id from the firmware's actual value, and populates the
dp_peers[] table. This lazy sync approach ensures the host always uses
the firmware's real ML peer_id regardless of any internal firmware
counter behavior.
Guard the dp_peers[] RCU table clear in ath12k_dp_peer_delete() and
ath12k_mac_dp_peer_cleanup() against ATH12K_DP_PEER_ID_INVALID to
avoid clearing uninitialized slots. Replace per-peer clear_bit() with
bitmap_zero() in ath12k_mac_dp_peer_cleanup() to avoid out-of-bounds
access when peer_id has not been synced yet.
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@xxxxxxxxxx>
---
drivers/net/wireless/ath/ath12k/dp_peer.c | 45 ++++++++++++++++-------
drivers/net/wireless/ath/ath12k/mac.c | 7 +++-
2 files changed, 36 insertions(+), 16 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_peer.c b/drivers/net/wireless/ath/ath12k/dp_peer.c
index 2660b4c7449b..0a7ef81425f5 100644
--- a/drivers/net/wireless/ath/ath12k/dp_peer.c
+++ b/drivers/net/wireless/ath/ath12k/dp_peer.c
@@ -413,8 +413,10 @@ u16 ath12k_dp_peer_get_peerid_index(struct ath12k_dp *dp, u16 peer_id)
struct ath12k_dp_peer *ath12k_dp_peer_find_by_peerid(struct ath12k_pdev_dp *dp_pdev,
u16 peer_id)
{
- u16 index;
+ struct ath12k_dp_hw *dp_hw = dp_pdev->dp_hw;
+ struct ath12k_dp_peer *dp_peer, *tmp;
struct ath12k_dp *dp = dp_pdev->dp;
+ u16 index;
RCU_LOCKDEP_WARN(!rcu_read_lock_held(),
"ath12k dp peer find by peerid index called without rcu lock");
@@ -423,8 +425,23 @@ struct ath12k_dp_peer *ath12k_dp_peer_find_by_peerid(struct ath12k_pdev_dp *dp_p
return NULL;
index = ath12k_dp_peer_get_peerid_index(dp, peer_id);
+ dp_peer = rcu_dereference(dp_hw->dp_peers[index]);
+
+ if (!dp_peer && (peer_id & ATH12K_PEER_ML_ID_VALID)) {
+ spin_lock_bh(&dp_hw->peer_lock);
+ list_for_each_entry(tmp, &dp_hw->dp_peers_list, list) {
+ if (tmp->is_mlo &&
+ tmp->peer_id == ATH12K_DP_PEER_ID_INVALID) {
+ tmp->peer_id = peer_id;
+ rcu_assign_pointer(dp_hw->dp_peers[index], tmp);
+ dp_peer = tmp;
+ break;
+ }
+ }
+ spin_unlock_bh(&dp_hw->peer_lock);
+ }
- return rcu_dereference(dp_pdev->dp_hw->dp_peers[index]);
+ return dp_peer;
}
EXPORT_SYMBOL(ath12k_dp_peer_find_by_peerid);
@@ -472,11 +489,11 @@ int ath12k_dp_peer_create(struct ath12k_dp_hw *dp_hw, u8 *addr,
dp_peer->is_mlo = params->is_mlo;
/*
- * For MLO client, the host assigns the ML peer ID, so set peer_id in dp_peer
- * For non-MLO client, host gets link peer ID from firmware and will be
- * assigned at the time of link peer creation
+ * peer_id starts as INVALID for both MLO and non-MLO clients.
+ * For MLO: synced from firmware's first data path descriptor.
+ * For non-MLO: assigned at the time of link peer creation.
*/
- dp_peer->peer_id = params->is_mlo ? params->peer_id : ATH12K_DP_PEER_ID_INVALID;
+ dp_peer->peer_id = ATH12K_DP_PEER_ID_INVALID;
dp_peer->ucast_ra_only = params->ucast_ra_only;
dp_peer->sec_type = HAL_ENCRYPT_TYPE_OPEN;
@@ -488,15 +505,12 @@ int ath12k_dp_peer_create(struct ath12k_dp_hw *dp_hw, u8 *addr,
list_add(&dp_peer->list, &dp_hw->dp_peers_list);
/*
- * For MLO client, the peer_id for ath12k_dp_peer is allocated by host
- * and that peer_id is known at this point, and hence this ath12k_dp_peer
- * can be added to the RCU table using the peer_id.
+ * For MLO client, the dp_peers[] RCU table entry will be populated
+ * when the firmware's actual peer_id is learned from the first data
+ * path descriptor (in ath12k_dp_peer_find_by_peerid).
* For non-MLO client, this addition to RCU table shall be done at the
* time of assignment of ath12k_dp_link_peer to ath12k_dp_peer.
*/
- if (dp_peer->is_mlo)
- rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id], dp_peer);
-
spin_unlock_bh(&dp_hw->peer_lock);
return 0;
@@ -515,8 +529,11 @@ void ath12k_dp_peer_delete(struct ath12k_dp_hw *dp_hw, u8 *addr,
return;
}
- if (dp_peer->is_mlo)
- rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id], NULL);
+ if (dp_peer->is_mlo) {
+ if (dp_peer->peer_id != ATH12K_DP_PEER_ID_INVALID)
+ rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id],
+ NULL);
+ }
list_del(&dp_peer->list);
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 3fa62deb8186..aa03491fb59a 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -1287,13 +1287,16 @@ void ath12k_mac_dp_peer_cleanup(struct ath12k_hw *ah)
spin_lock_bh(&dp_hw->peer_lock);
list_for_each_entry_safe(dp_peer, tmp, &dp_hw->dp_peers_list, list) {
if (dp_peer->is_mlo) {
- rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id], NULL);
- clear_bit(dp_peer->peer_id, ah->free_ml_peer_id_map);
+ if (dp_peer->peer_id != ATH12K_DP_PEER_ID_INVALID)
+ rcu_assign_pointer(dp_hw->dp_peers[dp_peer->peer_id],
+ NULL);
}
list_move(&dp_peer->list, &peers);
}
+ bitmap_zero(ah->free_ml_peer_id_map, ATH12K_MAX_MLO_PEERS);
+
spin_unlock_bh(&dp_hw->peer_lock);
synchronize_rcu();
--
2.54.0